Phar Signature format

Phars containing a signature always have the signature appended to the
end of the Phar archive after the loader, manifest, and file contents.
The two signature formats supported at this time are MD5 and SHA1.

Signature format

Length in bytes

Description

16 or 20 bytes

The actual signature, 20 bytes for an SHA1 signature,
16 bytes for an MD5 signature, 32 bytes for an SHA256 signature,
and 64 bytes for an SHA512 signature.

4 bytes

Signature flags. 0x0001 is used to
define an MD5 signature, 0x0002 is used
to define an SHA1 signature, 0x0004 is used
to define an SHA256 signature, and 0x0008 is
used to define an SHA512 signature. The SHA256 and SHA512 signature
support was introduced with API version 1.1.0.